Webhook

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

Export Lakewatch alerts to a webhook. When an alert is created, Lakewatch posts it as a JSON payload to an HTTPS endpoint you configure, where your own automation can act on it. For how export behaves across destinations, see Alert destinations.

Export to a webhook is one-way, from Lakewatch to your endpoint.

Webhook payload

When Lakewatch exports an alert to your webhook, it sends a JSON payload in an HTTP POST request. Lakewatch sends a lakewatch.alert.created event when the alert is created. It also sends a lakewatch.alert.updated event when the state, title, severity, description, classification, or assignee of an already-exported alert changes, but only when update delivery is enabled for the destination. When an alert closes, you receive an updated event with alert_state set to RESOLVED or DUPLICATE. There's no separate close event. To enable update delivery, select Also send alert updates in the settings. See Configure settings.

Lakewatch sends each event one time and doesn't retry if delivery fails. The alert still appears in Lakewatch.

note

Keys are snake_case. Enum fields are sent as their string names, for example "SECURITY_ALERT", not numbers. Unset optional fields are omitted from the JSON rather than sent as null, so a missing numeric field is absent, not 0.

Headers

Each request includes the following headers:

Content-Type: application/json
User-Agent: Databricks-Webhooks/1.0
X-Webhook-Event-Type: the event type
X-Delivery-Attempt-Id: the delivery attempt ID
X-Webhook-Timestamp: the delivery time in epoch milliseconds

Envelope fields

Field	Description
`event_type`	`lakewatch.alert.created` or `lakewatch.alert.updated`.
`delivery_attempt_id`	Unique for each delivery. A request that reaches you twice carries the same value. To match events for the same alert, use `alert_id`.
`delivery_time_millis`	Epoch milliseconds when the delivery was sent, not when the alert was created.
`data`	The alert object. See Alert fields.

Field	Description
`event_type`	`lakewatch.alert.created` or `lakewatch.alert.updated`.
`delivery_attempt_id`	Unique for each delivery. A request that reaches you twice carries the same value. To match events for the same alert, use `alert_id`.
`delivery_time_millis`	Epoch milliseconds when the delivery was sent, not when the alert was created.
`data`	The alert object. See Alert fields.

Alert fields

The data object contains the alert. The following fields are the ones most consumers act on:

Field	Description
`alert_id`	Globally unique alert ID (uuidv7). Use this field to match `created` and `updated` events for the same alert.
`seq_id`	Human-friendly display ID, for example `sec-42`. For display only, not a key.
`alert_type`	`SECURITY_ALERT`.
`alert_state`	One of `OPEN`, `IN_PROGRESS`, `MITIGATED`, `RESOLVED`, or `DUPLICATE`.
`severity`	One of `Informational`, `Low`, `Medium`, `High`, or `Critical`. Informational-severity alerts are not exported.
`title`	Short alert title.
`classification`	One of `FALSE_POSITIVE`, `BENIGN_POSITIVE`, or `TRUE_POSITIVE`. Unset until an analyst triages the alert, so it appears on `updated` events rather than at creation.
`assignee`	The principal the alert is assigned to. Unset until assigned, so it appears on `updated` events.
`alert_url`	Deep link to the alert in the Lakewatch UI. May be unset.
`created_at_millis`	Epoch milliseconds when the alert was created.
`created_by`	The principal that created the alert: `id`, `principal_type` (one of `REGULAR_USER`, `SERVICE_PRINCIPAL`, or `SYSTEM_USER`), `email`, and `display_name`.

Field	Description
`alert_id`	Globally unique alert ID (uuidv7). Use this field to match `created` and `updated` events for the same alert.
`seq_id`	Human-friendly display ID, for example `sec-42`. For display only, not a key.
`alert_type`	`SECURITY_ALERT`.
`alert_state`	One of `OPEN`, `IN_PROGRESS`, `MITIGATED`, `RESOLVED`, or `DUPLICATE`.
`severity`	One of `Informational`, `Low`, `Medium`, `High`, or `Critical`. Informational-severity alerts are not exported.
`title`	Short alert title.
`classification`	One of `FALSE_POSITIVE`, `BENIGN_POSITIVE`, or `TRUE_POSITIVE`. Unset until an analyst triages the alert, so it appears on `updated` events rather than at creation.
`assignee`	The principal the alert is assigned to. Unset until assigned, so it appears on `updated` events.
`alert_url`	Deep link to the alert in the Lakewatch UI. May be unset.
`created_at_millis`	Epoch milliseconds when the alert was created.
`created_by`	The principal that created the alert: `id`, `principal_type` (one of `REGULAR_USER`, `SERVICE_PRINCIPAL`, or `SYSTEM_USER`), `email`, and `display_name`.

The payload can also include name (the alert's resource name), description, rule_version, first_event_summary, first_event_at_millis, last_event_at_millis, total_event_count, and triggering_signal (the representative security event).

The following is an example lakewatch.alert.created payload:

JSON
{
  "delivery_attempt_id": "fde7344f-2786-4516-a30b-dbd920207c9c",
  "event_type": "lakewatch.alert.created",
  "delivery_time_millis": 1790205121081,
  "data": {
    "name": "rules/4b54c235-39e7-476e-aac8-260f123f4533/alerts/81030035-3fa7-4ac2-859f-4215ebeca2d9",
    "alert_id": "81030035-3fa7-4ac2-859f-4215ebeca2d9",
    "seq_id": "sec-512",
    "alert_type": "SECURITY_ALERT",
    "alert_state": "OPEN",
    "severity": "Medium",
    "title": "Suspicious login activity",
    "alert_url": "https://<workspace-host>/lakewatch/explore/alerts/sec-512",
    "first_event_summary": "Multiple failed logins from a new location",
    "total_event_count": 1,
    "created_at_millis": 1790204960768,
    "created_by": {
      "id": "147014482147330",
      "principal_type": "REGULAR_USER",
      "email": "analyst@example.com",
      "display_name": "Alex Analyst"
    }
  }
}

An updated event has the same shape, with event_type set to lakewatch.alert.updated, the current alert_state, and post-creation fields such as classification and assignee populated.

Prerequisites

An HTTPS endpoint that accepts POST requests and can process the alert JSON payload. The endpoint must be reachable from the public internet. Lakewatch can't deliver to private networks, such as endpoints behind Private Link.

Set up a webhook as an alert destination

Configure a webhook destination for alerts in the Alerts settings section.

In the Lakewatch sidebar, go to Settings, then open Alerts.
Under Delivery, set Alert destination to Webhook.
In Webhook URL, enter the endpoint that alerts are posted to.
Save your changes.

For the full alert settings reference, see Configure settings.

Troubleshooting

Payloads don't reach your endpoint: the URL is wrong, or the endpoint doesn't accept POST requests. Confirm the URL and that the endpoint is reachable and accepts a JSON POST.
The configuration doesn't save: the webhook URL doesn't use HTTPS or points to a private network. Confirm the URL starts with https:// and that the endpoint is reachable from the public internet.

Webhook payload​

Headers​

Envelope fields​

Alert fields​

Prerequisites​

Set up a webhook as an alert destination​

Troubleshooting​